Top Risks

• NewTab override combined with search permission creates search-monetization surface on every new tab.
• Uninstall and install URL hijacks redirect users to gameograf.com for tracking/monetization.
• Two innerHTML DOM-XSS sinks with no CSP present; MV3 lacks strict CSP enforcement here.
• No developer name listed in store; reduces accountability despite verified publisher status.
• Low install count (376) limits blast radius but extension remains a persistent tracking vehicle.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new-tab page.
• uninstall_url_hijack crx setUninstallURL targets gameograf.com with UTM tracking params.
• install_url_hijack crx onInstalled opens gameograf.com with UTM install tracking params.
• csp_absent_mv3 manifest content_security_policy is null; MV3 but no explicit CSP hardens DOM-XSS findings.
• dom_xss_sinks crx 2 innerHTML assignments from variables in popup.js and calendar.js; no CSP mitigation.
• verified_publisher store gameograf.com is verified publisher; domain resolves and is not throwaway.
• privacy_policy_adequate api Policy fetched, scoped to extension, data_collection+retention+third_party_sharing all disclosed.
• no_developer_name store developer_name is empty string; no display name shown in store listing.

Permissions Breakdown

• search medium Access to search queries; medium risk for a NewTab override that may intercept searches.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain only; low surface area.
• chrome_url_overrides.newtab medium Replaces new-tab page; prime surface for monetization and search hijacking.

Pillar Scores

Bookkeeping